[newlib-cygwin.git] / winsup / cygwin / security.h

/* security.h: security declarations

   Copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,
   2010, 2011, 2012 Red Hat, Inc.

This file is part of Cygwin.

This software is a copyrighted work licensed under the terms of the
Cygwin license.  Please consult the file "CYGWIN_LICENSE" for
details. */

#pragma once

#include <accctrl.h>

/* Special file attribute set, for instance, in open() and mkdir() to
   flag that a file has just been created.  Used in alloc_sd, see there. */
#define S_JUSTCREATED 0x80000000

#define DEFAULT_UID DOMAIN_USER_RID_ADMIN
#define UNKNOWN_UID 400 /* Non conflicting number */
#define UNKNOWN_GID 401

#define MAX_SID_LEN 40
#define MAX_DACL_LEN(n) (sizeof (ACL) \
		   + (n) * (sizeof (ACCESS_ALLOWED_ACE) - sizeof (DWORD) + MAX_SID_LEN))
#define SD_MIN_SIZE (sizeof (SECURITY_DESCRIPTOR) + MAX_DACL_LEN (1))
#define ACL_MAXIMUM_SIZE 65532	/* Yeah, right.  64K - sizeof (DWORD). */
#define SD_MAXIMUM_SIZE 65536
#define NO_SID ((PSID)NULL)

#ifndef SE_CREATE_TOKEN_PRIVILEGE
#define SE_CREATE_TOKEN_PRIVILEGE            2UL
#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE      3UL
#define SE_LOCK_MEMORY_PRIVILEGE             4UL
#define SE_INCREASE_QUOTA_PRIVILEGE          5UL
#define SE_MACHINE_ACCOUNT_PRIVILEGE         6UL
#define SE_TCB_PRIVILEGE                     7UL
#define SE_SECURITY_PRIVILEGE                8UL
#define SE_TAKE_OWNERSHIP_PRIVILEGE          9UL
#define SE_LOAD_DRIVER_PRIVILEGE            10UL
#define SE_SYSTEM_PROFILE_PRIVILEGE         11UL
#define SE_SYSTEMTIME_PRIVILEGE             12UL
#define SE_PROF_SINGLE_PROCESS_PRIVILEGE    13UL
#define SE_INC_BASE_PRIORITY_PRIVILEGE      14UL
#define SE_CREATE_PAGEFILE_PRIVILEGE        15UL
#define SE_CREATE_PERMANENT_PRIVILEGE       16UL
#define SE_BACKUP_PRIVILEGE                 17UL
#define SE_RESTORE_PRIVILEGE                18UL
#define SE_SHUTDOWN_PRIVILEGE               19UL
#define SE_DEBUG_PRIVILEGE                  20UL
#define SE_AUDIT_PRIVILEGE                  21UL
#define SE_SYSTEM_ENVIRONMENT_PRIVILEGE     22UL
#define SE_CHANGE_NOTIFY_PRIVILEGE          23UL
#define SE_REMOTE_SHUTDOWN_PRIVILEGE        24UL
/* Starting with Windows 2000 */
#define SE_UNDOCK_PRIVILEGE                 25UL
#define SE_SYNC_AGENT_PRIVILEGE             26UL
#define SE_ENABLE_DELEGATION_PRIVILEGE      27UL
#define SE_MANAGE_VOLUME_PRIVILEGE          28UL
/* Starting with Windows 2000 SP4, XP SP2, 2003 Server */
#define SE_IMPERSONATE_PRIVILEGE            29UL
#define SE_CREATE_GLOBAL_PRIVILEGE          30UL
/* Starting with Vista */
#define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE 31UL
#define SE_RELABEL_PRIVILEGE                32UL
#define SE_INCREASE_WORKING_SET_PRIVILEGE   33UL
#define SE_TIME_ZONE_PRIVILEGE              34UL
#define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE   35UL

#define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_SYMBOLIC_LINK_PRIVILEGE

#endif /* ! SE_CREATE_TOKEN_PRIVILEGE */

/* Added for debugging purposes. */
typedef struct {
  BYTE  Revision;
  BYTE  SubAuthorityCount;
  SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
  DWORD SubAuthority[8];
} DBGSID, *PDBGSID;

/* Macro to define variable length SID structures */
#define MKSID(name, comment, authority, count, rid...) \
static NO_COPY struct  { \
  BYTE  Revision; \
  BYTE  SubAuthorityCount; \
  SID_IDENTIFIER_AUTHORITY IdentifierAuthority; \
  DWORD SubAuthority[count]; \
} name##_struct = { SID_REVISION, count, {authority}, {rid}}; \
cygpsid NO_COPY name = (PSID) &name##_struct;

#define FILE_READ_BITS   (FILE_READ_DATA | GENERIC_READ | GENERIC_ALL)
#define FILE_WRITE_BITS  (FILE_WRITE_DATA | GENERIC_WRITE | GENERIC_ALL)
#define FILE_EXEC_BITS   (FILE_EXECUTE | GENERIC_EXECUTE | GENERIC_ALL)

#ifdef __cplusplus
extern "C"
{
#endif
  /* We need these declarations, otherwise g++ complains that the below
     inline methods use an undefined function, if ntdll.h isn't included. */
  BOOLEAN NTAPI RtlEqualSid (PSID, PSID);
  NTSTATUS NTAPI RtlCopySid (ULONG, PSID, PSID);
#ifdef __cplusplus
}
#endif

class cygpsid {
protected:
  PSID psid;
public:
  cygpsid () {}
  cygpsid (PSID nsid) { psid = nsid; }
  operator PSID () const { return psid; }
  const PSID operator= (PSID nsid) { return psid = nsid;}
  __uid32_t get_id (BOOL search_grp, int *type = NULL);
  int get_uid () { return get_id (FALSE); }
  int get_gid () { return get_id (TRUE); }

  PWCHAR string (PWCHAR nsidstr) const;
  char *string (char *nsidstr) const;

  bool operator== (const PSID nsid) const
    {
      if (!psid || !nsid)
	return nsid == psid;
      return RtlEqualSid (psid, nsid);
    }
  bool operator!= (const PSID nsid) const
    { return !(*this == nsid); }
  bool operator== (const char *nsidstr) const;
  bool operator!= (const char *nsidstr) const
    { return !(*this == nsidstr); }

  void debug_print (const char *prefix = NULL) const
    {
      char buf[256] __attribute__ ((unused));
      debug_printf ("%s %s", prefix ?: "", string (buf) ?: "NULL");
    }
};

class cygsid : public cygpsid {
  char sbuf[MAX_SID_LEN];
  bool well_known_sid;

  const PSID getfromstr (const char *nsidstr, bool well_known);
  PSID get_sid (DWORD s, DWORD cnt, DWORD *r, bool well_known);

  inline const PSID assign (const PSID nsid, bool well_known)
    {
      if (!nsid)
	psid = NO_SID;
      else
	{
	  psid = (PSID) sbuf;
	  RtlCopySid (MAX_SID_LEN, psid, nsid);
	  well_known_sid = well_known;
	}
      return psid;
    }

public:
  inline operator const PSID () { return psid; }
  inline bool is_well_known_sid () { return well_known_sid; }

  /* Both, = and *= are assignment operators.  = creates a "normal" SID,
     *= marks the SID as being a well-known SID.  This difference is
     important when creating a SID list for LSA authentication. */
  inline const PSID operator= (cygsid &nsid)
    { return assign (nsid, nsid.well_known_sid); }
  inline const PSID operator= (const PSID nsid)
    { return assign (nsid, false); }
  inline const PSID operator= (const char *nsidstr)
    { return getfromstr (nsidstr, false); }
  inline const PSID operator*= (cygsid &nsid)
    { return assign (nsid, true); }
  inline const PSID operator*= (const PSID nsid)
    { return assign (nsid, true); }
  inline const PSID operator*= (const char *nsidstr)
    { return getfromstr (nsidstr, true); }

  inline cygsid () : cygpsid ((PSID) sbuf), well_known_sid (false) {}
  inline cygsid (const PSID nsid) { *this = nsid; }
  inline cygsid (const char *nstrsid) { *this = nstrsid; }

  inline PSID set () { return psid = (PSID) sbuf; }

  BOOL getfrompw (const struct passwd *pw);
  BOOL getfromgr (const struct __group32 *gr);

  void debug_print (const char *prefix = NULL) const
    {
      char buf[256] __attribute__ ((unused));
      debug_printf ("%s %s%s", prefix ?: "", string (buf) ?: "NULL", well_known_sid ? " (*)" : " (+)");
    }
};

typedef enum { cygsidlist_empty, cygsidlist_alloc, cygsidlist_auto } cygsidlist_type;
class cygsidlist {
  int maxcnt;
  int cnt;

  BOOL add (const PSID nsi, bool well_known); /* Only with auto for now */

public:
  cygsid *sids;
  cygsidlist_type type;

  cygsidlist (cygsidlist_type t, int m)
  : maxcnt (m), cnt (0), type (t)
    {
      if (t == cygsidlist_alloc)
	sids = alloc_sids (m);
      else
	sids = new cygsid [m];
    }
  ~cygsidlist () { if (type == cygsidlist_auto) delete [] sids; }

  BOOL addfromgr (struct __group32 *gr) /* Only with alloc */
    { return sids[cnt].getfromgr (gr) && ++cnt; }

  /* += adds a "normal" SID, *= adds a well-known SID.  See comment in class
     cygsid above. */
  BOOL operator+= (cygsid &si) { return add ((PSID) si,
					     si.is_well_known_sid ()); }
  BOOL operator+= (const char *sidstr) { cygsid nsi (sidstr);
					 return add ((PSID) nsi,
						     nsi.is_well_known_sid ());
				       }
  BOOL operator+= (const PSID psid) { return add (psid, false); }
  BOOL operator*= (cygsid &si) { return add ((PSID) si, true); }
  BOOL operator*= (const char *sidstr) { cygsid nsi (sidstr);
					 return add ((PSID) nsi, true); }
  BOOL operator*= (const PSID psid) { return add (psid, true); }

  void count (int ncnt)
    { cnt = ncnt; }
  int count () const { return cnt; }
  int non_well_known_count () const
    {
      int wcnt = 0;
      for (int i = 0; i < cnt; ++i)
	if (!sids[i].is_well_known_sid ())
	  ++wcnt;
      return wcnt;
    }

  int position (const PSID sid) const
    {
      for (int i = 0; i < cnt; ++i)
	if (sids[i] == sid)
	  return i;
      return -1;
    }

  int next_non_well_known_sid (int idx)
    {
      while (++idx < cnt)
	if (!sids[idx].is_well_known_sid ())
	  return idx;
      return -1;
    }
  BOOL contains (const PSID sid) const { return position (sid) >= 0; }
  cygsid *alloc_sids (int n);
  void free_sids ();
  void debug_print (const char *prefix = NULL) const
    {
      debug_printf ("-- begin sidlist ---");
      if (!cnt)
	debug_printf ("No elements");
      for (int i = 0; i < cnt; ++i)
	sids[i].debug_print (prefix);
      debug_printf ("-- ende sidlist ---");
    }
};

/* Wrapper class to allow simple deleting of buffer space allocated
   by read_sd() */
class security_descriptor {
protected:
  PSECURITY_DESCRIPTOR psd;
  DWORD sd_size;
public:
  security_descriptor () : psd (NULL), sd_size (0) {}
  ~security_descriptor () { free (); }

  PSECURITY_DESCRIPTOR malloc (size_t nsize);
  PSECURITY_DESCRIPTOR realloc (size_t nsize);
  void free ();

  inline DWORD size () const { return sd_size; }
  inline DWORD copy (void *buf, DWORD buf_size) const {
    if (buf_size < size ())
      return sd_size;
    memcpy (buf, psd, sd_size);
    return 0;
  }
  inline operator const PSECURITY_DESCRIPTOR () { return psd; }
  inline operator PSECURITY_DESCRIPTOR *() { return &psd; }
  inline void operator =(PSECURITY_DESCRIPTOR nsd) { psd = nsd; }
};

class user_groups {
public:
  cygsid pgsid;
  cygsidlist sgsids;
  BOOL ischanged;

  BOOL issetgroups () const { return (sgsids.type == cygsidlist_alloc); }
  void update_supp (const cygsidlist &newsids)
    {
      sgsids.free_sids ();
      sgsids = newsids;
      ischanged = TRUE;
    }
  void clear_supp ()
    {
      if (issetgroups ())
	{
	  sgsids.free_sids ();
	  ischanged = TRUE;
	}
    }
  void update_pgrp (const PSID sid)
    {
      pgsid = sid;
      ischanged = TRUE;
    }
};

extern cygpsid well_known_null_sid;
extern cygpsid well_known_world_sid;
extern cygpsid well_known_local_sid;
extern cygpsid well_known_console_logon_sid;
extern cygpsid well_known_creator_owner_sid;
extern cygpsid well_known_creator_group_sid;
extern cygpsid well_known_dialup_sid;
extern cygpsid well_known_network_sid;
extern cygpsid well_known_batch_sid;
extern cygpsid well_known_interactive_sid;
extern cygpsid well_known_service_sid;
extern cygpsid well_known_authenticated_users_sid;
extern cygpsid well_known_this_org_sid;
extern cygpsid well_known_system_sid;
extern cygpsid well_known_builtin_sid;
extern cygpsid well_known_admins_sid;
extern cygpsid well_known_users_sid;
extern cygpsid fake_logon_sid;
extern cygpsid mandatory_medium_integrity_sid;
extern cygpsid mandatory_high_integrity_sid;
extern cygpsid mandatory_system_integrity_sid;
extern cygpsid well_known_samba_unix_user_fake_sid;

bool privilege_luid (const PWCHAR pname, LUID &luid, bool &high_integrity);

inline BOOL
well_known_sid_type (SID_NAME_USE type)
{
  return type == SidTypeAlias || type == SidTypeWellKnownGroup;
}

inline BOOL
legal_sid_type (SID_NAME_USE type)
{
  return type == SidTypeUser  || type == SidTypeGroup
      || type == SidTypeAlias || type == SidTypeWellKnownGroup;
}

class path_conv;
/* File manipulation */
int __stdcall get_file_attribute (HANDLE, path_conv &, mode_t *,
				  __uid32_t *, __gid32_t *)
		__attribute__ ((regparm (3)));
int __stdcall set_file_attribute (HANDLE, path_conv &,
				  __uid32_t, __gid32_t, mode_t)
		__attribute__ ((regparm (3)));
int __stdcall get_object_sd (HANDLE, security_descriptor &)
		__attribute__ ((regparm (2)));
int __stdcall get_object_attribute (HANDLE, __uid32_t *, __gid32_t *, mode_t *)
		__attribute__ ((regparm (3)));
int __stdcall set_object_attribute (HANDLE, __uid32_t, __gid32_t, mode_t)
		__attribute__ ((regparm (3)));
int __stdcall create_object_sd_from_attribute (HANDLE, __uid32_t, __gid32_t,
					       mode_t, security_descriptor &)
		__attribute__ ((regparm (3)));
int __stdcall set_object_sd (HANDLE, security_descriptor &, bool)
		__attribute__ ((regparm (3)));

int __stdcall get_reg_attribute (HKEY hkey, mode_t *, __uid32_t *, __gid32_t *)
		__attribute__ ((regparm (3)));
LONG __stdcall get_file_sd (HANDLE fh, path_conv &, security_descriptor &, bool)
		__attribute__ ((regparm (3)));
LONG __stdcall set_file_sd (HANDLE fh, path_conv &, security_descriptor &, bool)
		__attribute__ ((regparm (3)));
bool __stdcall add_access_allowed_ace (PACL, int, DWORD, PSID, size_t &, DWORD)
		__attribute__ ((regparm (3)));
bool __stdcall add_access_denied_ace (PACL, int, DWORD, PSID, size_t &, DWORD)
		__attribute__ ((regparm (3)));
int __stdcall check_file_access (path_conv &, int, bool)
		__attribute__ ((regparm (3)));
int __stdcall check_registry_access (HANDLE, int, bool)
		__attribute__ ((regparm (3)));

void set_security_attribute (path_conv &pc, int attribute,
			     PSECURITY_ATTRIBUTES psa,
			     security_descriptor &sd_buf);

bool get_sids_info (cygpsid, cygpsid, __uid32_t * , __gid32_t *);

/* sec_acl.cc */
struct __acl32;
extern "C" int aclsort32 (int, int, __acl32 *);
extern "C" int acl32 (const char *, int, int, __acl32 *);
int getacl (HANDLE, path_conv &, int, __acl32 *);
int setacl (HANDLE, path_conv &, int, __acl32 *, bool &);

/* Set impersonation or restricted token.  */
void set_imp_token (HANDLE token, int type);
/* Function creating a token by calling NtCreateToken. */
HANDLE create_token (cygsid &usersid, user_groups &groups, struct passwd * pw);
/* LSA authentication function. */
HANDLE lsaauth (cygsid &, user_groups &, struct passwd *);
/* LSA private key storage authentication, same as when using service logons. */
HANDLE lsaprivkeyauth (struct passwd *pw);
/* Verify an existing token */
bool verify_token (HANDLE token, cygsid &usersid, user_groups &groups, bool *pintern = NULL);
/* Get groups of a user */
bool get_server_groups (cygsidlist &grp_list, PSID usersid, struct passwd *pw);

/* Extract U-domain\user field from passwd entry. */
void extract_nt_dom_user (const struct passwd *pw, PWCHAR domain, PWCHAR user);
/* Get default logonserver for a domain. */
bool get_logon_server (PWCHAR domain, PWCHAR wserver, bool rediscovery);

HANDLE open_local_policy (ACCESS_MASK access);

/* sec_helper.cc: Security helper functions. */
int set_privilege (HANDLE token, DWORD privilege, bool enable);
void set_cygwin_privileges (HANDLE token);

#define _push_thread_privilege(_priv, _val, _check) { \
    HANDLE _dup_token = NULL; \
    HANDLE _token = (cygheap->user.issetuid () && (_check)) \
		    ? cygheap->user.primary_token () : hProcToken; \
    if (!DuplicateTokenEx (_token, MAXIMUM_ALLOWED, NULL, \
			   SecurityImpersonation, TokenImpersonation, \
			   &_dup_token)) \
      debug_printf ("DuplicateTokenEx: %E"); \
    else if (!ImpersonateLoggedOnUser (_dup_token)) \
      debug_printf ("ImpersonateLoggedOnUser: %E"); \
    else \
      set_privilege (_dup_token, (_priv), (_val));

#define push_thread_privilege(_priv, _val) _push_thread_privilege(_priv,_val,1)
#define push_self_privilege(_priv, _val)   _push_thread_privilege(_priv,_val,0)

#define pop_thread_privilege() \
    if (_dup_token) \
      { \
	if (!cygheap->user.issetuid ()) \
	  RevertToSelf (); \
	else \
	  cygheap->user.reimpersonate (); \
	CloseHandle (_dup_token); \
      } \
  }

#define pop_self_privilege()		   pop_thread_privilege()

/* shared.cc: */

/* Various types of security attributes for use in Create* functions. */
extern SECURITY_ATTRIBUTES sec_none, sec_none_nih, sec_all, sec_all_nih;
extern SECURITY_ATTRIBUTES *__stdcall __sec_user (PVOID, PSID, PSID,
						  DWORD, BOOL)
		__attribute__ ((regparm (3)));

extern PSECURITY_DESCRIPTOR _recycler_sd (void *buf, bool users, bool dir);
#define recycler_sd(users,dir) \
  (_recycler_sd (alloca (sizeof (SECURITY_DESCRIPTOR) + MAX_DACL_LEN (3)), \
		 (users), \
		 (dir)))

extern PSECURITY_DESCRIPTOR _everyone_sd (void *buf, ACCESS_MASK access);
#define everyone_sd(access)	(_everyone_sd (alloca (SD_MIN_SIZE), (access)))

#define sec_none_cloexec(f) (((f) & O_CLOEXEC ? &sec_none_nih : &sec_none))

extern bool sec_acl (PACL acl, bool original, bool admins, PSID sid1 = NO_SID,
		     PSID sid2 = NO_SID, DWORD access2 = 0);

ssize_t __stdcall read_ea (HANDLE, path_conv &, const char *,
			   char *, size_t)
		__attribute__ ((regparm (3)));
int __stdcall write_ea (HANDLE, path_conv &, const char *, const char *,
			size_t, int)
		__attribute__ ((regparm (3)));

/* Note: sid1 is usually (read: currently always) the current user's
   effective sid (cygheap->user.sid ()). */
extern inline SECURITY_ATTRIBUTES *
sec_user_nih (SECURITY_ATTRIBUTES *sa_buf, PSID sid1, PSID sid2 = NULL,
	      DWORD access2 = 0)
{
  return __sec_user (sa_buf, sid1, sid2, access2, FALSE);
}

extern inline SECURITY_ATTRIBUTES *
sec_user (SECURITY_ATTRIBUTES *sa_buf, PSID sid1, PSID sid2 = NULL,
	  DWORD access2 = 0)
{
  return __sec_user (sa_buf, sid1, sid2, access2, TRUE);
}
Commit	Line	Data
f0338f54 CF	1	/* security.h: security declarations
f0338f54 CF	2
9f00d746	3	Copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,
d560c4b2	4	2010, 2011, 2012 Red Hat, Inc.
f0338f54 CF	5
	6	This file is part of Cygwin.
	7
	8	This software is a copyrighted work licensed under the terms of the
	9	Cygwin license. Please consult the file "CYGWIN_LICENSE" for
	10	details. */
	11
962f9a2c	12	#pragma once
7119fc0d	13
74fcdaec	14	#include <accctrl.h>
c0d1968a	15
b42441d3 CV	16	/* Special file attribute set, for instance, in open() and mkdir() to
	17	flag that a file has just been created. Used in alloc_sd, see there. */
	18	#define S_JUSTCREATED 0x80000000
	19
17db1105	20	#define DEFAULT_UID DOMAIN_USER_RID_ADMIN
565e8015 CV	21	#define UNKNOWN_UID 400 /* Non conflicting number */
565e8015 CV	22	#define UNKNOWN_GID 401
17db1105	23
2b0a111f	24	#define MAX_SID_LEN 40
043bc3e1 CV	25	#define MAX_DACL_LEN(n) (sizeof (ACL) \
043bc3e1 CV	26	+ (n) * (sizeof (ACCESS_ALLOWED_ACE) - sizeof (DWORD) + MAX_SID_LEN))
db5ae618	27	#define SD_MIN_SIZE (sizeof (SECURITY_DESCRIPTOR) + MAX_DACL_LEN (1))
4e8f539f CV	28	#define ACL_MAXIMUM_SIZE 65532 /* Yeah, right. 64K - sizeof (DWORD). */
4e8f539f CV	29	#define SD_MAXIMUM_SIZE 65536
2b0a111f CV	30	#define NO_SID ((PSID)NULL)
2b0a111f CV	31
cce28460 CV	32	#ifndef SE_CREATE_TOKEN_PRIVILEGE
	33	#define SE_CREATE_TOKEN_PRIVILEGE 2UL
	34	#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE 3UL
	35	#define SE_LOCK_MEMORY_PRIVILEGE 4UL
	36	#define SE_INCREASE_QUOTA_PRIVILEGE 5UL
	37	#define SE_MACHINE_ACCOUNT_PRIVILEGE 6UL
	38	#define SE_TCB_PRIVILEGE 7UL
	39	#define SE_SECURITY_PRIVILEGE 8UL
	40	#define SE_TAKE_OWNERSHIP_PRIVILEGE 9UL
	41	#define SE_LOAD_DRIVER_PRIVILEGE 10UL
	42	#define SE_SYSTEM_PROFILE_PRIVILEGE 11UL
	43	#define SE_SYSTEMTIME_PRIVILEGE 12UL
	44	#define SE_PROF_SINGLE_PROCESS_PRIVILEGE 13UL
	45	#define SE_INC_BASE_PRIORITY_PRIVILEGE 14UL
	46	#define SE_CREATE_PAGEFILE_PRIVILEGE 15UL
	47	#define SE_CREATE_PERMANENT_PRIVILEGE 16UL
	48	#define SE_BACKUP_PRIVILEGE 17UL
	49	#define SE_RESTORE_PRIVILEGE 18UL
	50	#define SE_SHUTDOWN_PRIVILEGE 19UL
	51	#define SE_DEBUG_PRIVILEGE 20UL
	52	#define SE_AUDIT_PRIVILEGE 21UL
	53	#define SE_SYSTEM_ENVIRONMENT_PRIVILEGE 22UL
	54	#define SE_CHANGE_NOTIFY_PRIVILEGE 23UL
	55	#define SE_REMOTE_SHUTDOWN_PRIVILEGE 24UL
	56	/* Starting with Windows 2000 */
	57	#define SE_UNDOCK_PRIVILEGE 25UL
	58	#define SE_SYNC_AGENT_PRIVILEGE 26UL
	59	#define SE_ENABLE_DELEGATION_PRIVILEGE 27UL
	60	#define SE_MANAGE_VOLUME_PRIVILEGE 28UL
	61	/* Starting with Windows 2000 SP4, XP SP2, 2003 Server */
	62	#define SE_IMPERSONATE_PRIVILEGE 29UL
	63	#define SE_CREATE_GLOBAL_PRIVILEGE 30UL
	64	/* Starting with Vista */
	65	#define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE 31UL
	66	#define SE_RELABEL_PRIVILEGE 32UL
	67	#define SE_INCREASE_WORKING_SET_PRIVILEGE 33UL
	68	#define SE_TIME_ZONE_PRIVILEGE 34UL
	69	#define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE 35UL
	70
	71	#define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_SYMBOLIC_LINK_PRIVILEGE
	72
	73	#endif /* ! SE_CREATE_TOKEN_PRIVILEGE */
	74
124b187f CV	75	/* Added for debugging purposes. */
	76	typedef struct {
	77	BYTE Revision;
	78	BYTE SubAuthorityCount;
	79	SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
	80	DWORD SubAuthority[8];
	81	} DBGSID, *PDBGSID;
	82
d82c6f47	83	/* Macro to define variable length SID structures */
124b187f	84	#define MKSID(name, comment, authority, count, rid...) \
d82c6f47 CV	85	static NO_COPY struct { \
	86	BYTE Revision; \
	87	BYTE SubAuthorityCount; \
	88	SID_IDENTIFIER_AUTHORITY IdentifierAuthority; \
	89	DWORD SubAuthority[count]; \
	90	} name##_struct = { SID_REVISION, count, {authority}, {rid}}; \
	91	cygpsid NO_COPY name = (PSID) &name##_struct;
	92
3db69078 CV	93	#define FILE_READ_BITS (FILE_READ_DATA \| GENERIC_READ \| GENERIC_ALL)
	94	#define FILE_WRITE_BITS (FILE_WRITE_DATA \| GENERIC_WRITE \| GENERIC_ALL)
	95	#define FILE_EXEC_BITS (FILE_EXECUTE \| GENERIC_EXECUTE \| GENERIC_ALL)
	96
5735d5f6 CV	97	#ifdef __cplusplus
	98	extern "C"
	99	{
	100	#endif
	101	/* We need these declarations, otherwise g++ complains that the below
	102	inline methods use an undefined function, if ntdll.h isn't included. */
	103	BOOLEAN NTAPI RtlEqualSid (PSID, PSID);
	104	NTSTATUS NTAPI RtlCopySid (ULONG, PSID, PSID);
	105	#ifdef __cplusplus
	106	}
	107	#endif
	108
4a21c2d5 CV	109	class cygpsid {
4a21c2d5 CV	110	protected:
d551169a	111	PSID psid;
4a21c2d5 CV	112	public:
	113	cygpsid () {}
	114	cygpsid (PSID nsid) { psid = nsid; }
2be593d9	115	operator PSID () const { return psid; }
4a21c2d5 CV	116	const PSID operator= (PSID nsid) { return psid = nsid;}
	117	__uid32_t get_id (BOOL search_grp, int *type = NULL);
	118	int get_uid () { return get_id (FALSE); }
	119	int get_gid () { return get_id (TRUE); }
	120
7b4b41ab	121	PWCHAR string (PWCHAR nsidstr) const;
4a21c2d5 CV	122	char string (char nsidstr) const;
	123
	124	bool operator== (const PSID nsid) const
	125	{
	126	if (!psid \|\| !nsid)
	127	return nsid == psid;
5735d5f6	128	return RtlEqualSid (psid, nsid);
4a21c2d5 CV	129	}
	130	bool operator!= (const PSID nsid) const
	131	{ return !(*this == nsid); }
	132	bool operator== (const char *nsidstr) const;
	133	bool operator!= (const char *nsidstr) const
	134	{ return !(*this == nsidstr); }
	135
	136	void debug_print (const char *prefix = NULL) const
	137	{
db30fe12	138	char buf[256] __attribute__ ((unused));
4a21c2d5 CV	139	debug_printf ("%s %s", prefix ?: "", string (buf) ?: "NULL");
	140	}
	141	};
	142
	143	class cygsid : public cygpsid {
d551169a	144	char sbuf[MAX_SID_LEN];
b825c587	145	bool well_known_sid;
2b0a111f	146
b825c587 CV	147	const PSID getfromstr (const char *nsidstr, bool well_known);
b825c587 CV	148	PSID get_sid (DWORD s, DWORD cnt, DWORD *r, bool well_known);
2b0a111f	149
b825c587	150	inline const PSID assign (const PSID nsid, bool well_known)
1fcc912f CV	151	{
1fcc912f CV	152	if (!nsid)
1ff9f4b9	153	psid = NO_SID;
1fcc912f	154	else
1ff9f4b9 CF	155	{
1ff9f4b9 CF	156	psid = (PSID) sbuf;
5735d5f6	157	RtlCopySid (MAX_SID_LEN, psid, nsid);
b825c587	158	well_known_sid = well_known;
1ff9f4b9	159	}
1fcc912f CV	160	return psid;
	161	}
	162
d551169a	163	public:
243a041b	164	inline operator const PSID () { return psid; }
b825c587	165	inline bool is_well_known_sid () { return well_known_sid; }
243a041b	166
b825c587 CV	167	/* Both, = and *= are assignment operators. = creates a "normal" SID,
	168	*= marks the SID as being a well-known SID. This difference is
	169	important when creating a SID list for LSA authentication. */
243a041b	170	inline const PSID operator= (cygsid &nsid)
b825c587	171	{ return assign (nsid, nsid.well_known_sid); }
243a041b	172	inline const PSID operator= (const PSID nsid)
b825c587	173	{ return assign (nsid, false); }
243a041b	174	inline const PSID operator= (const char *nsidstr)
b825c587 CV	175	{ return getfromstr (nsidstr, false); }
	176	inline const PSID operator*= (cygsid &nsid)
	177	{ return assign (nsid, true); }
	178	inline const PSID operator*= (const PSID nsid)
	179	{ return assign (nsid, true); }
	180	inline const PSID operator= (const char nsidstr)
	181	{ return getfromstr (nsidstr, true); }
	182
	183	inline cygsid () : cygpsid ((PSID) sbuf), well_known_sid (false) {}
2b0a111f CV	184	inline cygsid (const PSID nsid) { *this = nsid; }
2b0a111f CV	185	inline cygsid (const char nstrsid) { this = nstrsid; }
d551169a CV	186
	187	inline PSID set () { return psid = (PSID) sbuf; }
	188
b2939a81	189	BOOL getfrompw (const struct passwd *pw);
57196405	190	BOOL getfromgr (const struct __group32 *gr);
b825c587 CV	191
	192	void debug_print (const char *prefix = NULL) const
	193	{
	194	char buf[256] __attribute__ ((unused));
	195	debug_printf ("%s %s%s", prefix ?: "", string (buf) ?: "NULL", well_known_sid ? " (*)" : " (+)");
	196	}
1fcc912f CV	197	};
1fcc912f CV	198
5a8746b7	199	typedef enum { cygsidlist_empty, cygsidlist_alloc, cygsidlist_auto } cygsidlist_type;
1fcc912f	200	class cygsidlist {
b825c587 CV	201	int maxcnt;
	202	int cnt;
	203
	204	BOOL add (const PSID nsi, bool well_known); /* Only with auto for now */
	205
1fcc912f	206	public:
1fcc912f	207	cygsid *sids;
5519d543	208	cygsidlist_type type;
1fcc912f	209
5519d543	210	cygsidlist (cygsidlist_type t, int m)
b825c587	211	: maxcnt (m), cnt (0), type (t)
5519d543	212	{
5519d543 CV	213	if (t == cygsidlist_alloc)
	214	sids = alloc_sids (m);
	215	else
	216	sids = new cygsid [m];
	217	}
	218	~cygsidlist () { if (type == cygsidlist_auto) delete [] sids; }
1fcc912f	219
b825c587 CV	220	BOOL addfromgr (struct __group32 gr) / Only with alloc */
	221	{ return sids[cnt].getfromgr (gr) && ++cnt; }
	222
	223	/* += adds a "normal" SID, *= adds a well-known SID. See comment in class
	224	cygsid above. */
d560c4b2 CV	225	BOOL operator+= (cygsid &si) { return add ((PSID) si,
d560c4b2 CV	226	si.is_well_known_sid ()); }
b825c587	227	BOOL operator+= (const char *sidstr) { cygsid nsi (sidstr);
d560c4b2 CV	228	return add ((PSID) nsi,
	229	nsi.is_well_known_sid ());
	230	}
b825c587 CV	231	BOOL operator+= (const PSID psid) { return add (psid, false); }
	232	BOOL operator*= (cygsid &si) { return add ((PSID) si, true); }
	233	BOOL operator= (const char sidstr) { cygsid nsi (sidstr);
70300fdb	234	return add ((PSID) nsi, true); }
b825c587 CV	235	BOOL operator*= (const PSID psid) { return add (psid, true); }
	236
	237	void count (int ncnt)
	238	{ cnt = ncnt; }
	239	int count () const { return cnt; }
	240	int non_well_known_count () const
1fcc912f	241	{
b825c587 CV	242	int wcnt = 0;
b825c587 CV	243	for (int i = 0; i < cnt; ++i)
70300fdb	244	if (!sids[i].is_well_known_sid ())
b825c587 CV	245	++wcnt;
b825c587 CV	246	return wcnt;
1fcc912f	247	}
1fcc912f	248
5519d543	249	int position (const PSID sid) const
1fcc912f	250	{
b825c587	251	for (int i = 0; i < cnt; ++i)
1ff9f4b9	252	if (sids[i] == sid)
5519d543 CV	253	return i;
5519d543 CV	254	return -1;
1fcc912f	255	}
5519d543	256
b825c587 CV	257	int next_non_well_known_sid (int idx)
	258	{
	259	while (++idx < cnt)
70300fdb	260	if (!sids[idx].is_well_known_sid ())
b825c587 CV	261	return idx;
	262	return -1;
	263	}
5519d543 CV	264	BOOL contains (const PSID sid) const { return position (sid) >= 0; }
	265	cygsid *alloc_sids (int n);
	266	void free_sids ();
1fcc912f CV	267	void debug_print (const char *prefix = NULL) const
	268	{
	269	debug_printf ("-- begin sidlist ---");
b825c587	270	if (!cnt)
1ff9f4b9	271	debug_printf ("No elements");
b825c587	272	for (int i = 0; i < cnt; ++i)
1ff9f4b9	273	sids[i].debug_print (prefix);
1fcc912f CV	274	debug_printf ("-- ende sidlist ---");
1fcc912f CV	275	}
d551169a CV	276	};
d551169a CV	277
12069cf3 CV	278	/* Wrapper class to allow simple deleting of buffer space allocated
	279	by read_sd() */
	280	class security_descriptor {
	281	protected:
	282	PSECURITY_DESCRIPTOR psd;
	283	DWORD sd_size;
	284	public:
97b09fe1	285	security_descriptor () : psd (NULL), sd_size (0) {}
12069cf3 CV	286	~security_descriptor () { free (); }
	287
	288	PSECURITY_DESCRIPTOR malloc (size_t nsize);
	289	PSECURITY_DESCRIPTOR realloc (size_t nsize);
2f9ae2ed	290	void free ();
12069cf3	291
97b09fe1 CV	292	inline DWORD size () const { return sd_size; }
97b09fe1 CV	293	inline DWORD copy (void *buf, DWORD buf_size) const {
2be593d9 CV	294	if (buf_size < size ())
	295	return sd_size;
	296	memcpy (buf, psd, sd_size);
	297	return 0;
	298	}
12069cf3	299	inline operator const PSECURITY_DESCRIPTOR () { return psd; }
2be593d9	300	inline operator PSECURITY_DESCRIPTOR *() { return &psd; }
b42441d3	301	inline void operator =(PSECURITY_DESCRIPTOR nsd) { psd = nsd; }
12069cf3 CV	302	};
12069cf3 CV	303
5519d543 CV	304	class user_groups {
	305	public:
	306	cygsid pgsid;
	307	cygsidlist sgsids;
	308	BOOL ischanged;
	309
	310	BOOL issetgroups () const { return (sgsids.type == cygsidlist_alloc); }
	311	void update_supp (const cygsidlist &newsids)
	312	{
	313	sgsids.free_sids ();
	314	sgsids = newsids;
	315	ischanged = TRUE;
	316	}
5a8746b7 CV	317	void clear_supp ()
5a8746b7 CV	318	{
4a21c2d5	319	if (issetgroups ())
a113a3c5	320	{
4a21c2d5 CV	321	sgsids.free_sids ();
	322	ischanged = TRUE;
	323	}
5a8746b7	324	}
5519d543 CV	325	void update_pgrp (const PSID sid)
	326	{
	327	pgsid = sid;
	328	ischanged = TRUE;
	329	}
	330	};
	331
d82c6f47 CV	332	extern cygpsid well_known_null_sid;
	333	extern cygpsid well_known_world_sid;
	334	extern cygpsid well_known_local_sid;
c52fd6cd	335	extern cygpsid well_known_console_logon_sid;
d82c6f47 CV	336	extern cygpsid well_known_creator_owner_sid;
	337	extern cygpsid well_known_creator_group_sid;
	338	extern cygpsid well_known_dialup_sid;
	339	extern cygpsid well_known_network_sid;
	340	extern cygpsid well_known_batch_sid;
	341	extern cygpsid well_known_interactive_sid;
	342	extern cygpsid well_known_service_sid;
	343	extern cygpsid well_known_authenticated_users_sid;
2fd2ddf3	344	extern cygpsid well_known_this_org_sid;
d82c6f47	345	extern cygpsid well_known_system_sid;
e122c471	346	extern cygpsid well_known_builtin_sid;
d82c6f47	347	extern cygpsid well_known_admins_sid;
9f00d746	348	extern cygpsid well_known_users_sid;
b825c587	349	extern cygpsid fake_logon_sid;
b1138f3d CV	350	extern cygpsid mandatory_medium_integrity_sid;
	351	extern cygpsid mandatory_high_integrity_sid;
	352	extern cygpsid mandatory_system_integrity_sid;
2d647173	353	extern cygpsid well_known_samba_unix_user_fake_sid;
1fcc912f	354
c52fd6cd	355	bool privilege_luid (const PWCHAR pname, LUID &luid, bool &high_integrity);
f4a1f8a1	356
99edaded CV	357	inline BOOL
	358	well_known_sid_type (SID_NAME_USE type)
	359	{
	360	return type == SidTypeAlias \|\| type == SidTypeWellKnownGroup;
	361	}
	362
1fcc912f CV	363	inline BOOL
	364	legal_sid_type (SID_NAME_USE type)
	365	{
	366	return type == SidTypeUser \|\| type == SidTypeGroup
	367	\|\| type == SidTypeAlias \|\| type == SidTypeWellKnownGroup;
	368	}
2b0a111f	369
66a83f3e	370	class path_conv;
f0338f54	371	/* File manipulation */
eea4e482	372	int __stdcall get_file_attribute (HANDLE, path_conv &, mode_t *,
67a93078 CV	373	__uid32_t , __gid32_t )
67a93078 CV	374	__attribute__ ((regparm (3)));
eea4e482	375	int __stdcall set_file_attribute (HANDLE, path_conv &,
67a93078 CV	376	__uid32_t, __gid32_t, mode_t)
	377	__attribute__ ((regparm (3)));
	378	int __stdcall get_object_sd (HANDLE, security_descriptor &)
	379	__attribute__ ((regparm (2)));
	380	int __stdcall get_object_attribute (HANDLE, __uid32_t , __gid32_t , mode_t *)
	381	__attribute__ ((regparm (3)));
	382	int __stdcall set_object_attribute (HANDLE, __uid32_t, __gid32_t, mode_t)
	383	__attribute__ ((regparm (3)));
cc01c77f	384	int __stdcall create_object_sd_from_attribute (HANDLE, __uid32_t, __gid32_t,
67a93078 CV	385	mode_t, security_descriptor &)
	386	__attribute__ ((regparm (3)));
	387	int __stdcall set_object_sd (HANDLE, security_descriptor &, bool)
	388	__attribute__ ((regparm (3)));
	389
	390	int __stdcall get_reg_attribute (HKEY hkey, mode_t , __uid32_t , __gid32_t *)
	391	__attribute__ ((regparm (3)));
	392	LONG __stdcall get_file_sd (HANDLE fh, path_conv &, security_descriptor &, bool)
	393	__attribute__ ((regparm (3)));
	394	LONG __stdcall set_file_sd (HANDLE fh, path_conv &, security_descriptor &, bool)
	395	__attribute__ ((regparm (3)));
	396	bool __stdcall add_access_allowed_ace (PACL, int, DWORD, PSID, size_t &, DWORD)
	397	__attribute__ ((regparm (3)));
	398	bool __stdcall add_access_denied_ace (PACL, int, DWORD, PSID, size_t &, DWORD)
	399	__attribute__ ((regparm (3)));
	400	int __stdcall check_file_access (path_conv &, int, bool)
	401	__attribute__ ((regparm (3)));
	402	int __stdcall check_registry_access (HANDLE, int, bool)
	403	__attribute__ ((regparm (3)));
c0d1968a	404
88797e59 CV	405	void set_security_attribute (path_conv &pc, int attribute,
88797e59 CV	406	PSECURITY_ATTRIBUTES psa,
12069cf3	407	security_descriptor &sd_buf);
86fb0393	408
4a21c2d5 CV	409	bool get_sids_info (cygpsid, cygpsid, __uid32_t * , __gid32_t *);
4a21c2d5 CV	410
e3d1d515 CV	411	/* sec_acl.cc */
	412	struct __acl32;
	413	extern "C" int aclsort32 (int, int, __acl32 *);
	414	extern "C" int acl32 (const char , int, int, __acl32 );
eea4e482 CV	415	int getacl (HANDLE, path_conv &, int, __acl32 *);
eea4e482 CV	416	int setacl (HANDLE, path_conv &, int, __acl32 *, bool &);
e3d1d515	417
0191627a CV	418	/* Set impersonation or restricted token. */
0191627a CV	419	void set_imp_token (HANDLE token, int type);
b825c587	420	/* Function creating a token by calling NtCreateToken. */
26684e48	421	HANDLE create_token (cygsid &usersid, user_groups &groups, struct passwd * pw);
b825c587 CV	422	/* LSA authentication function. */
b825c587 CV	423	HANDLE lsaauth (cygsid &, user_groups &, struct passwd *);
51303cbd CV	424	/* LSA private key storage authentication, same as when using service logons. */
51303cbd CV	425	HANDLE lsaprivkeyauth (struct passwd *pw);
ebbdc703	426	/* Verify an existing token */
2e008fb9	427	bool verify_token (HANDLE token, cygsid &usersid, user_groups &groups, bool *pintern = NULL);
68a3f0d3 CV	428	/* Get groups of a user */
68a3f0d3 CV	429	bool get_server_groups (cygsidlist &grp_list, PSID usersid, struct passwd *pw);
1fcc912f CV	430
1fcc912f CV	431	/* Extract U-domain\user field from passwd entry. */
b5488135	432	void extract_nt_dom_user (const struct passwd *pw, PWCHAR domain, PWCHAR user);
1eb934b7	433	/* Get default logonserver for a domain. */
5558de95	434	bool get_logon_server (PWCHAR domain, PWCHAR wserver, bool rediscovery);
c0d1968a	435
51303cbd CV	436	HANDLE open_local_policy (ACCESS_MASK access);
51303cbd CV	437
c0d1968a	438	/* sec_helper.cc: Security helper functions. */
cce28460	439	int set_privilege (HANDLE token, DWORD privilege, bool enable);
f4a1f8a1 CV	440	void set_cygwin_privileges (HANDLE token);
f4a1f8a1 CV	441
f4a1f8a1	442	#define _push_thread_privilege(_priv, _val, _check) { \
a76877e9 CV	443	HANDLE _dup_token = NULL; \
a76877e9 CV	444	HANDLE _token = (cygheap->user.issetuid () && (_check)) \
77ee8805	445	? cygheap->user.primary_token () : hProcToken; \
a76877e9 CV	446	if (!DuplicateTokenEx (_token, MAXIMUM_ALLOWED, NULL, \
	447	SecurityImpersonation, TokenImpersonation, \
	448	&_dup_token)) \
	449	debug_printf ("DuplicateTokenEx: %E"); \
	450	else if (!ImpersonateLoggedOnUser (_dup_token)) \
	451	debug_printf ("ImpersonateLoggedOnUser: %E"); \
	452	else \
cce28460	453	set_privilege (_dup_token, (_priv), (_val));
a76877e9	454
f4a1f8a1 CV	455	#define push_thread_privilege(_priv, _val) _push_thread_privilege(_priv,_val,1)
	456	#define push_self_privilege(_priv, _val) _push_thread_privilege(_priv,_val,0)
	457
	458	#define pop_thread_privilege() \
	459	if (_dup_token) \
	460	{ \
fd1bf882	461	if (!cygheap->user.issetuid ()) \
5684cfeb CV	462	RevertToSelf (); \
5684cfeb CV	463	else \
fd1bf882	464	cygheap->user.reimpersonate (); \
f4a1f8a1 CV	465	CloseHandle (_dup_token); \
	466	} \
	467	}
a76877e9	468
f4a1f8a1	469	#define pop_self_privilege() pop_thread_privilege()
f0338f54	470
c0d1968a	471	/* shared.cc: */
c0d1968a	472
f0338f54 CF	473	/* Various types of security attributes for use in Create* functions. */
f0338f54 CF	474	extern SECURITY_ATTRIBUTES sec_none, sec_none_nih, sec_all, sec_all_nih;
67a93078 CV	475	extern SECURITY_ATTRIBUTES *__stdcall __sec_user (PVOID, PSID, PSID,
	476	DWORD, BOOL)
	477	__attribute__ ((regparm (3)));
115d74b9 CV	478
	479	extern PSECURITY_DESCRIPTOR _recycler_sd (void *buf, bool users, bool dir);
	480	#define recycler_sd(users,dir) \
	481	(_recycler_sd (alloca (sizeof (SECURITY_DESCRIPTOR) + MAX_DACL_LEN (3)), \
	482	(users), \
	483	(dir)))
	484
db5ae618 CV	485	extern PSECURITY_DESCRIPTOR _everyone_sd (void *buf, ACCESS_MASK access);
	486	#define everyone_sd(access) (_everyone_sd (alloca (SD_MIN_SIZE), (access)))
	487
e70fdfb9 CV	488	#define sec_none_cloexec(f) (((f) & O_CLOEXEC ? &sec_none_nih : &sec_none))
e70fdfb9 CV	489
264f41f0	490	extern bool sec_acl (PACL acl, bool original, bool admins, PSID sid1 = NO_SID,
c61ada9b	491	PSID sid2 = NO_SID, DWORD access2 = 0);
f0338f54	492
67a93078 CV	493	ssize_t __stdcall read_ea (HANDLE, path_conv &, const char *,
	494	char *, size_t)
	495	__attribute__ ((regparm (3)));
	496	int __stdcall write_ea (HANDLE, path_conv &, const char , const char ,
	497	size_t, int)
	498	__attribute__ ((regparm (3)));
cecb74ae	499
bb094105 CV	500	/* Note: sid1 is usually (read: currently always) the current user's
bb094105 CV	501	effective sid (cygheap->user.sid ()). */
cecb74ae	502	extern inline SECURITY_ATTRIBUTES *
bb094105	503	sec_user_nih (SECURITY_ATTRIBUTES *sa_buf, PSID sid1, PSID sid2 = NULL,
7311cc1f	504	DWORD access2 = 0)
cecb74ae	505	{
c61ada9b	506	return __sec_user (sa_buf, sid1, sid2, access2, FALSE);
cecb74ae CF	507	}
	508
	509	extern inline SECURITY_ATTRIBUTES *
bb094105	510	sec_user (SECURITY_ATTRIBUTES *sa_buf, PSID sid1, PSID sid2 = NULL,
7311cc1f	511	DWORD access2 = 0)
cecb74ae	512	{
c61ada9b	513	return __sec_user (sa_buf, sid1, sid2, access2, TRUE);
cecb74ae	514	}